Release 2025-12-15

.github/workflows/continuous-integration.yml

@@ -5,15 +5,15 @@ on: push
 jobs:
     build:
         name: build
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-22.04
         steps:
             - name: Checkout
-              uses: actions/checkout@v2
+              uses: actions/checkout@v4
               with:
                   fetch-depth: 0 # This causes all history to be fetched, which is required for calculate-version to function
 
             - name: Install Python 3.8
-              uses: actions/setup-python@v1
+              uses: actions/setup-python@v5
               with:
                   python-version: 3.8
 
@@ -51,9 +51,9 @@ jobs:
               run: make install
 
             - name: Set SPEC_VERSION env var
-              run: echo ::set-env name=SPEC_VERSION::$(poetry run python scripts/calculate_version.py)
-              env:
-                  ACTIONS_ALLOW_UNSECURE_COMMANDS: true
+              run: |
+                  SPEC_VERSION=$(poetry run python scripts/calculate_version.py)
+                  echo "SPEC_VERSION=$SPEC_VERSION" >> "$GITHUB_ENV"
 
             - name: Create release (master only)
               id: create-release

.github/workflows/pr-lint.yaml

@@ -2,13 +2,30 @@ name: PR Quality Check
 on: pull_request
 jobs:
   link-ticket:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     defaults:
       run:
         shell: bash
     steps:
       - name: Check ticket name conforms to requirements
-        run: echo ${{ github.event.pull_request.head.ref }} | grep -i -E -q "((apm|niad|AMB|PI|amp)-[0-9]+)|(dependabot\/)|(release\/)"
+        if: >
+          !(
+            contains(github.event.pull_request.head.ref, 'dependabot/') ||
+            contains(github.event.pull_request.head.ref, 'release/') ||
+            contains(github.event.pull_request.head.ref, 'apm-') ||
+            contains(github.event.pull_request.head.ref, 'APM-') || 
+            contains(github.event.pull_request.head.ref, 'niad-') ||
+            contains(github.event.pull_request.head.ref, 'NIAD-') || 
+            contains(github.event.pull_request.head.ref, 'amb-') ||
+            contains(github.event.pull_request.head.ref, 'amp-') ||
+            contains(github.event.pull_request.head.ref, 'pi-') ||
+            contains(github.event.pull_request.head.ref, 'AMB-') || 
+            contains(github.event.pull_request.head.ref, 'AMP-') || 
+            contains(github.event.pull_request.head.ref, 'PI-')
+          )
+        run: |
+          echo "Branch name must contain a ticket (APM-123, NIAD-123, PI-123, etc)"
+          exit 1
 
       - name: Grab ticket name
         if: |
@@ -19,10 +36,10 @@ jobs:
           contains(github.event.pull_request.head.ref, 'AMB-') || 
           contains(github.event.pull_request.head.ref, 'AMP-') || 
           contains(github.event.pull_request.head.ref, 'PI-')
-        run: |
-          echo "TICKET_NAME=$(echo ${{ github.event.pull_request.head.ref }} | grep -i -o '\(apm\|niad\|pi\)-[0-9]\+' | tr '[:lower:]' '[:upper:]')" >> $GITHUB_ENV
         env:
-          ACTIONS_ALLOW_UNSECURE_COMMANDS: true
+          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}
+        run: |
+          echo "TICKET_NAME=$(echo "$BRANCH_NAME" | grep -i -o '\(apm\|niad\|pi\)-[0-9]\+' | tr '[:lower:]' '[:upper:]')" >> $GITHUB_ENV
 
       - name: Comment on PR
         if: |
@@ -33,7 +50,7 @@ jobs:
           contains(github.event.pull_request.head.ref, 'AMB-') || 
           contains(github.event.pull_request.head.ref, 'AMP-') || 
           contains(github.event.pull_request.head.ref, 'PI-')
-        uses: unsplash/comment-on-pr@master
+        uses: unsplash/comment-on-pr@a9bf050e744c8282dee4bb0dbcf063186d8316c4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/unit-tests.yml

@@ -4,19 +4,19 @@ on: pull_request
 
 jobs:
     build:
-        runs-on: ubuntu-20.04
+        runs-on: ubuntu-22.04
         defaults:
             run:
                 working-directory: ./docker/sds-api/spine-directory-service/sds
 
         steps:
-            - uses: actions/checkout@v1
+            - uses: actions/checkout@v4
             - name: Set up Python 3.8
-              uses: actions/setup-python@v1
+              uses: actions/setup-python@v5
               with:
                   python-version: 3.8
             - name: Install pipenv
-              uses: dschep/install-pipenv-action@v1
+              uses: dschep/install-pipenv-action@aaac0310d5f4a052d150e5f490b44354e08fbb8c
               with:
                   version: 2021.5.29
             - name: Install dependencies

Makefile

@@ -28,6 +28,7 @@ clean:
 	rm -rf dist
 
 publish: clean
+	python --version
 	mkdir -p build
 	npm run publish 2> /dev/null
 

README.md

@@ -180,6 +180,7 @@ Sandbox environment mimics real service behaviour - both correct HTTP 200 and cl
 Both /Endpoint and /Device has built in one response with data that can be fetched using query parameters specified below. All other combinations result with empty FHIR bundle simulating no result found.
 
 1. `/Endpoint`
+
 * `organization=https://fhir.nhs.uk/Id/ods-organization-code|YES`
 * `identifier=https://fhir.nhs.uk/Id/nhsEndpointServiceId|urn:nhs:names:services:psis:REPC_IN150016UK05`
 * `identifier=https://fhir.nhs.uk/Id/nhsMhsPartyKey|YES-0000806`
@@ -189,6 +190,7 @@ Query parametere `organization` is mandatory. At least one `identifier` must be
 Example: `/Endpoint?organization=https://fhir.nhs.uk/Id/ods-organization-code|YES&identifier=https://fhir.nhs.uk/Id/nhsEndpointServiceId|urn:nhs:names:services:psis:REPC_IN150016UK05&identifier=https://fhir.nhs.uk/Id/nhsMhsPartyKey|YES-0000806`
 
 2. `/Device`
+
 * `organization=https://fhir.nhs.uk/Id/ods-organization-code|YES`
 * `identifier=https://fhir.nhs.uk/Id/nhsEndpointServiceId|urn:nhs:names:services:psis:REPC_IN150016UK05`
 * `identifier=https://fhir.nhs.uk/Id/nhsMhsPartyKey|YES-0000806`

azure/azure-build-pipeline.yml

@@ -1,43 +1,45 @@
 name: "$(SourceBranchName)+$(BuildID)"
 
 trigger:
-  branches:
-    include:
-      - tags/refs/v*
-  tags:
-    include:
-      - v*
+    branches:
+        include:
+            - tags/refs/v*
+    tags:
+        include:
+            - v*
 
 pr:
-  branches:
-    include: ['*']
+    branches:
+        include: ["*"]
 
 resources:
-  repositories:
-    - repository: common
-      type: github
-      name: NHSDigital/api-management-utils
-      ref: refs/heads/edge
-      endpoint: NHSDigital
+    repositories:
+        - repository: common
+          type: github
+          name: NHSDigital/api-management-utils
+          ref: refs/heads/edge
+          endpoint: NHSDigital
 
 variables:
-  - template: project.yml
+    - template: project.yml
 
 extends:
-  template: azure/common/apigee-build.yml@common
-  parameters:
-    service_name: ${{ variables.service_name }}
-    short_service_name: ${{ variables.short_service_name }}
-    cache_steps:
-        - task: s3-cache-action@1
-          inputs:
-            key: 'node modules | ${{ variables.service_name }} | ${{ variables.service_name }}/package-lock.json'
-            location: '${{ variables.service_name }}/node_modules'
-            debug: true
-          displayName: cache node modules
-        - task: s3-cache-action@1
-          inputs:
-            key: 'poetry | ${{ variables.service_name }} | ${{ variables.service_name }}/poetry.lock'
-            location: '${{ variables.service_name }}/.venv'
-            debug: true
-          displayName: cache python dependencies
+    template: azure/common/apigee-build.yml@common
+
+    parameters:
+        python_version: ${{ variables.python_version }}
+        service_name: ${{ variables.service_name }}
+        short_service_name: ${{ variables.short_service_name }}
+        cache_steps:
+            - task: s3-cache-action@1
+              inputs:
+                  key: "node modules | ${{ variables.service_name }} | ${{ variables.service_name }}/package-lock.json"
+                  location: "${{ variables.service_name }}/node_modules"
+                  debug: true
+              displayName: cache node modules
+            - task: s3-cache-action@1
+              inputs:
+                  key: "poetry | ${{ variables.service_name }} | ${{ variables.service_name }}/poetry.lock"
+                  location: "${{ variables.service_name }}/.venv"
+                  debug: true
+              displayName: cache python dependencies

azure/azure-pr-pipeline.yml

@@ -4,57 +4,59 @@ trigger: none
 pr: none
 
 resources:
-  repositories:
-    - repository: common
-      type: github
-      name: NHSDigital/api-management-utils
-      ref: refs/heads/edge
-      endpoint: NHSDigital
-  pipelines:
-  - pipeline: build_pipeline
-    source: "Spine-Directory-Service-Build"
-    trigger:
-      branches:
-        exclude:
-          - master
-          - refs/heads/master
-          - refs/tags/v*
+    repositories:
+        - repository: common
+          type: github
+          name: NHSDigital/api-management-utils
+          ref: refs/heads/edge
+          endpoint: NHSDigital
+    pipelines:
+        - pipeline: build_pipeline
+          source: "Spine-Directory-Service-Build"
+          trigger:
+              branches:
+                  exclude:
+                      - master
+                      - refs/heads/master
+                      - refs/tags/v*
 
 pool:
-  name: 'AWS-ECS'
+    name: "AWS-ECS"
 
 variables:
-  - template: project.yml
+    - template: project.yml
 
 extends:
-  template: azure/common/apigee-deployment.yml@common
-  parameters:
-    service_name: ${{ variables.service_name }}
-    service_base_path: ${{ variables.service_base_path }}
-    short_service_name: ${{ variables.short_service_name }}
-    deploy_review_sandbox: true
-    secret_ids:
-      - ptl/client/ldap.nis1.national.ncrs.nhs.uk/key
-      - ptl/client/ldap.nis1.national.ncrs.nhs.uk/crt
-      - ptl/veit07.devspineservices.nhs.uk/root-ca/crt
-    config_ids:
-      - /ptl/api-deployment/sds/ldap/private-key
-      - /ptl/api-deployment/sds/ldap/client-cert
-      - /ptl/api-deployment/sds/ldap/ca-certs
-    jinja_templates:
-    hosted_target_healthcheck_suffix: /healthcheck/deep
-    apigee_deployments:
-      - environment: internal-dev
-        post_deploy:
-          - template: ./templates/run-tests.yml
-            parameters:
-              e2e_tests: true
-              smoke_tests: true
-              security_tests: true
-      - environment: internal-dev-sandbox
-        proxy_path: sandbox
-        post_deploy:
-          - template: ./templates/run-tests.yml
-            parameters:
-              e2e_tests: true
-              smoke_tests: true
+    template: azure/common/apigee-deployment.yml@common
+    parameters:
+        service_name: ${{ variables.service_name }}
+        service_base_path: ${{ variables.service_base_path }}
+        short_service_name: ${{ variables.short_service_name }}
+        deploy_review_sandbox: true
+        secret_ids:
+            - ptl/client/ldap.nis1.national.ncrs.nhs.uk/key
+            - ptl/client/ldap.nis1.national.ncrs.nhs.uk/crt
+            - ptl/veit07.devspineservices.nhs.uk/root-ca/crt
+        config_ids:
+            - /ptl/api-deployment/sds/ldap/private-key
+            - /ptl/api-deployment/sds/ldap/client-cert
+            - /ptl/api-deployment/sds/ldap/ca-certs
+        jinja_templates:
+        hosted_target_healthcheck_suffix: /healthcheck/deep
+        apigee_deployments:
+            - environment: internal-dev
+              post_deploy:
+                  - template: ./templates/run-tests.yml
+                    parameters:
+                        e2e_tests: true
+                        smoke_tests: true
+                        security_tests: true
+                        python_version: ${{ variables.python_version }}
+            - environment: internal-dev-sandbox
+              proxy_path: sandbox
+              post_deploy:
+                  - template: ./templates/run-tests.yml
+                    parameters:
+                        e2e_tests: true
+                        smoke_tests: true
+                        python_version: ${{ variables.python_version }}